Services · the fee card, opened up
the full fee card for small firms that keep privilege under lock
Five engagements, each written out below exactly as its scope letter will read: what we examine, what you’ll need ready on your side, how long it takes, and the fee — fixed before anything starts.
- priced
- in the first line of the scope letter
- billed
- once, by invoice, at hand-over
- settled by
- ACH, check or card
- range
- $415 to $1,375
- the first look
- phishing-simulation audit
- written incident-response plan
- microsoft 365 hardening review
- tabletop rehearsal
Work orders · five engagements
every engagement, written out the way its scope letter will read
Nothing on this page is a starting bid. The fee beside each numeral is the fee on the invoice, and the list under “ready on your side” is everything we’ll ask of your office.
-
$415 two hours with you, one page within three working days
Fits a firm that has never had anyone look
the first look
A partner walks us through an ordinary day: how people sign in, where client files live, how a wire gets approved, who still has a key to the shared drive. We watch, ask, and take notes by hand. Within three working days you receive one written page — the three things to fix first, in the order we’d fix them.
What we examine
- sign-in and multi-factor coverage
- where client files are shared, and with whom
- how money leaves the firm
- accounts belonging to people who’ve left
- backups — and whether anyone has tried a restore
- the front-desk computer nobody claims
-
$640 two to three weeks of lures, then a thirty-minute session
Fits a firm that wonders what staff would click
phishing-simulation audit
Three rounds of lures written for your practice — an e-signature request on a retainer agreement, a client’s “updated wire details”, a convincing Microsoft sign-in page — sent on ordinary workdays across two to three weeks. We note who opened, who entered a password, and, most usefully, who reported it. Then a blame-free half-hour with staff. Names stay out of the findings.
What we examine
- clicks and entered passwords, round by round
- how quickly a lure gets reported, and to whom
- whether the Report button is switched on
- external-sender tagging on incoming mail
- which pretext your office finds most believable
-
$865 two interviews, the bound plan within a fortnight
Fits a firm whose insurer asked for a plan
written incident-response plan
One interview with a partner, one with your office manager, and we write the plan your firm would actually follow at 8:40 on a Tuesday when a client folder won’t open. Who calls whom, in what order; when to ring your cyber insurer before anyone touches a machine; Connecticut’s breach-notice timing; what to tell clients, and in whose voice.
What you receive
- a bound plan with tabbed sections
- a one-page contact tree for the wall
- your insurer’s notice steps, in sequence
- draft client-notice letters, ready to adapt
- an editable copy you own outright
-
$1,180 read-only access, findings folio within a fortnight
Fits a firm that lives in Outlook and SharePoint
microsoft 365 hardening review
Read-only, setting by setting, against the licence you actually pay for. Every finding in the folio arrives with a screenshot, the exact path to the setting, the change we recommend, and the name of who in your office should make it — so your IT person can work straight down the list.
What we examine
- MFA, and the accounts that slipped past it
- conditional access and legacy sign-in
- mailbox forwarding and hidden inbox rules
- external sharing in SharePoint and OneDrive
- who holds admin roles, and why
- audit logging, and how much history it keeps
-
$1,375 ninety minutes round your table, a letter within the week
Fits a firm with a plan nobody has opened
tabletop rehearsal
A staged ransomware morning, run around your conference table. The trouble arrives on printed cards — reception can’t open the client folder, the bank rings about a wire, a client emails asking whether their return is safe — and your partners work the problem from your own written plan. We note where the plan held and where it gave, then send an after-action letter within the week.
What you receive
- a scenario written for your practice area
- printed inject cards, kept for next year
- an after-action letter, ranked by consequence
- marked-up edits to your written plan
not sure which numeral fits your office? describe it out loud
Tell us how many people sign in, what kind of files you hold, and what kept you up last month. We’ll name the engagement — and if it’s the $415 first look, we’ll say so.
Side by side
how long each one takes, and what it asks of your staff
Read across a row to see the whole job in one line. The column most partners care about is the second one: how much of their own billable time an engagement will cost.
| Engagement | On your desk | Staff time asked | Access we need | You keep | Fee |
|---|---|---|---|---|---|
| i. the first look | within three working days | one partner, two hours | none — we watch you work | one written page | $415 |
| ii. phishing-simulation audit | a week after the last round | thirty minutes, everyone | one allow-list entry | findings and session notes | $640 |
| iii. incident-response plan | within a fortnight | two interviews, an hour each | your insurance policy | bound plan, wall tree | $865 |
| iv. microsoft 365 review | within a fortnight | a thirty-minute kickoff | Global Reader, time-boxed | findings folio, setting by setting | $1,180 |
| v. tabletop rehearsal | letter within the week | partners, ninety minutes | your written plan | inject cards, after-action letter | $1,375 |
Every engagement ends with the hand-over hour described on the home page fee card — at your office or at our bench on Dwight St. It is included in the fee, not added to it.
The bench calendar
booked around April 15th and the closing table, not across them
A phishing lure tells you nothing in the week a preparer is filing forty extensions. This is the year we’d suggest for each kind of practice — a habit of the trade, not a rule. Bring us your own calendar and we’ll work to it.
an accounting practice
a law practice
Booking notes
a kickoff date belongs in the scope letter, so we write it there
- lures land on ordinary days
- We won’t run a phishing round in the week of a real deadline or a closing. The point is to see a normal Tuesday, not a frantic one.
- the plan comes before the rehearsal
- A tabletop needs a written plan to work from. If you don’t have one, engagement iii is usually booked a month or two ahead of engagement v.
- a strange login doesn’t wait for the calendar
- If something already looks wrong — an inbox rule nobody made, a wire request with new details — ring the bench first, weekdays 11am–5:30pm, and say so at the start of the call.
pencil a kickoff in before the quiet weeks are spoken for
Email the engagement you’re leaning towards and the month that suits your office. The scope letter returns with the date, the fee and our signature already on it.
What isn’t on the card
the drawer we keep shut, and the reasons it stays that way
A locksmith who also sells alarms has a reason to find your doors weak. Keeping the trade narrow is how the findings stay honest — so these four jobs we turn down, politely and every time.
-
Not offered: round-the-clock monitoring
We aren’t a night watch. If your firm needs someone reading alerts at three in the morning, that’s a managed security provider — and we’re glad to help you write the questions to put to one.
-
Not offered: running your IT
Your IT person keeps the machines turning over. We check the locks they fitted and hand them a work list; we don’t replace them, and we don’t take the keys home.
-
Not offered: reselling software
No licences, no tools, no referral fees. A finding in our folio is never the first line of a sales pitch, because there is nothing behind it to sell.
-
Not offered: breaking into web applications
Application penetration testing is its own trade, with its own tools and its own apprenticeship. We’d rather tell you that plainly than dabble in it on your client portal.
Between two drawers
an odd job that’s nearly on the card
Two practices merging their Microsoft 365 tenants. A partner retiring and every account they touched. An office move with the server riding in the back of a car. Describe it, and we’ll quote it in writing before a minute is spent.
describe the odd jobthe scoping call is free, and so is the scope letter it produces
Twenty minutes on the phone, weekdays 11am–5:30pm. You hang up knowing which engagement, which month, and the exact fee.